Operations that failed to recover data successfully on IBM X225

[Data recovery failure description]

A government organization in Xinjiang, MS SQL Server server, the hardware environment is: IBM X225, composed of 4 73G SCSI hard drives in the Raid5,raid only one logical volume is divided. The operating system is Windows 2003.

A, did not find a fault before, until the server is paralyzed, and then check the server, found 3 hard drives offline.

B, arbitrarily forced online 2 hard drive, unable to start the operating system.

C, when you start the operating system using the WinPE CD, you can see the data and copy the backup zip database files to the removable hard disk.

D, the zip file is tested on another machine and cannot be decompressed correctly.

E, please correspond with maintenance company to help restore.

F, its maintenance company replaced a new RAID card, directly rebuilt into a group of RAID5.

G, the customer thinks the zip file size, the name is correct, should be able to repair, so directly in the raid on the system and normal work, while trying to repair the zip file, tried for 1 days, no results. At this point, ask the data recovery company for help.

[Data Recovery conclusion]

Unlike the data recovery cases I've described before, I'm just saying the final conclusion of data recovery:

Data is severely damaged, and ultimately, it is not recoverable by customer.

[Case Study]

For the above fault description for the following analysis:

Fault description A, in the use of RAID5 do storage, be sure to maintain the normal raid in time, when RAID5 a hard drive off the line, to timely backup data to another storage body, and then timely rebuild failure raid.

Fault description B, RAID5 exists more than 2 hard drive offline, must be able to choose the hard drive online, if the wrong choice, in some cases, a boot system, the entire RAID state will change, it is possible to destroy important data. How do we respond to the raid damage? 》

Fault description c, with PE you can see the directory because the directory area is normal or part of normal, and not necessarily the normal data area, in fact, the system can not start means that the forced line operation is wrong, should not continue. Reading the directory in PE has actually loaded the file system and has corrupted the metadata area of the normal file system (it is only possible to destroy data that does not affect the recovery)

In fault description d, a zip file cannot be decompressed, which means that the raid structure is wrong. Actually forced to line up 2 disk (at this time there are 3 disk online, only one disk offline), but this 3 disk has a piece is already offline, so the combined data is fresh and stale mixed together, although the directory is correct, But the data area is messy. This time did not have comprehensive data synchronization to these 3 hard disks, basically still can restore completely.

Fault Description E, if the agreement with the maintenance company to determine the data recovery project, you can let it on behalf of the processing (but it is best to consult a number of professional data recovery companies to determine the way to deal with). If the maintenance company does not have the service scope of data recovery, it is best to select the data recovery company directly. In most cases, if the customer directly to the maintenance company, the maintenance company to find data recovery company, may lead to increased costs (sometimes terrible), while the data security, data recovery process of the specification is not directly controlled.

In fault description F, rebuilding RAID5 is the most lethal operation in this example. When the IBM X225 uses the server RAID SUPPORT CD to rebuild RAID, it will clear all 0 of the data by default. Even for other servers, rebuilding raid typically synchronizes the checksum and disrupts the original data structure. But it takes a while for the process to complete, and if it doesn't, the rest of the data will have a chance to recover.

In the fault description G, after one day, the 73G RAID member disk has been synchronized. The data was completely destroyed.